1. Technical Field
The present invention relates generally to an apparatus and method for recovering a partition using backup boot record information and more particularly, to an apparatus and method for recovering a partition, which can perform fast partition recovery using a backup boot record.
2. Description of the Related Art
A hard disk is divided into a plurality of partitions so as to efficiently operate the disk, and is managed based on the partitions. Among the partitions, a Disk Operating System (DOS) partition that is the most typically used enables partitions to be managed through a partition table and also enables a plurality of partitions to be managed using the concept of an extended partition.
In digital forensics, in order to recover a deleted partition when a partition has been deleted, methods of recovering the partition in such is way that a user manually searches for partition information or analyzes a partition table are used. In this case, a problem arises in that, with the development of hardware, the capacity of to disk has increased, so a lot of time is required in order to search for information about a deleted partition, and in that when recovery is manually conducted, a user must have technical knowledge.
In detail, conventional technology for recovering a partition is implemented using a method of checking a disk map provided by a forensic tool and directly and manually adding the deleted partition, or a method of analyzing a Master Boot Record (MBR), sequentially searching all sectors for deleted partition information, and then recovering the deleted partition. However, such conventional technology is disadvantageous in that, in order to manually add the deleted partition, a user must have technical knowledge, and the method of sequentially accessing and searching all sectors requires a long time, from a minimum of several tens of minutes to a maximum of several tens of hours depending on the disk capacity.
Korean Unexamined Patent Publication No. 2008-0107629 discloses a method of recovering a system using a previously created backup file necessary for booting, but the technology disclosed in this patent is intended to recover an operating system, and is limited in that a previously deleted partition is not taken into consideration.
Therefore, an efficient partition recovery method and apparatus are required which provide partition, recovery information found in a hard disk or an evidence image to a user within a short period of time and which manage the recovered partition.